Benign Download

Backdoor.Win32.Hupigon.dmtc

Image list icon size importExecute shell command (ShellExecuteA)

SHA-256c487b091d03bccee09a261d4b4683cd1722db7330c7292741843e78434eab3e7

Evidence

Query/set system parameters (string) 0xa27de–0xa287e

0xa27de6765000000005472616e736c6174654dge....TranslateM
0xa27ee4449537973416363656c000000005472DISysAccel....Tr
0xa27fe61636b506f7075704d656e7500000000ackPopupMenu....
0xa280e53797374656d506172616d6574657273SystemParameters
0xa281e496e666f4100000053686f7757696e64InfoA...ShowWind
0xa282e6f770000000053686f775363726f6c6cow....ShowScroll
⋯5 more rows

Query/set system parameters (symbol) 0xa6640–0xa6730

0xa6640fffaf6004b392900c69a72006d564200....K9)...r.mVB.
0xa6650dcb38e00eac4a200f5d1b200f0cdaf00................
0xa6660fad6b700fad7b800d1b49a00f0d0b400................
0xa6670fadbc000f0d3ba00c9b19c00fbdec500................
0xa6680f9dcc3007c6e6200f7dec800fef4eb00....|nb.........
⋯11 more rows

Execute shell command (ShellExecuteA) 0xa6838–0xa6a08

⋯13 more rows
0xa6908616fe4e5e1e1eb33b1b281a0758e8da2ao.....3....u...
0xa6918481dfe00000037725830351962010101H.....7rX05.b...
0xa6928cb7a2fe3e8e2e5379ab0b3838c8f8e8d.z/....7........
0xa6938481dfe0000253c30302e26010101cf99H....%<00.&.....
0xa694899cbcc56e3e6e7e632afb281a48e8f8e...V....2.......
0xa6958481dfe00003d3030634101ae69cb57ccH....=00cA..i.W.
0xa6968ae4d79603839e8e7eb3d809da08fa58f.My`89...=......
0xa6978481dfe00aa313c3c64c3ae7b5a5b197dH....1<<d..{Z[.}
0xa6988cdc3404a3e35eae7e632b0b3a08fa9a5..@J>5...2......
0xa6998481dfe006531434e5490796e3b3a4334H...e1CNT.yn;:C4
⋯7 more rows